Examers.io
ExamsOrganizationsHow it worksPricingHelp & FAQ
Sign inStart free
PALO ALTO NETWORKS

Palo Alto Networks Certified Cloud Security Engineer

CLOUD-SECURITY-ENGINEERPalo Alto Networks Cloud Security Engineer

The Palo Alto Networks Certified Cloud Security Engineer certification validates the expertise required to secure multicloud estates from code development through production runtime using Cortex Cloud. It is designed for experienced cloud security engineers who plan CNAPP deployments, manage cloud posture and workload protection, and drive automated remediation across the SDLC. Earning it demonstrates job-ready skills for deploying and managing cloud security tooling at scale.

Practice Free Questions

792 practice questions · Updated 2026-07-30

6Domains
35Objectives
230Concepts
792Questions

CLOUD-SECURITY-ENGINEER Curriculum

Every domain, objective, and concept the CLOUD-SECURITY-ENGINEER exam measures.

1.2 Determine Cortex Cloud deployment and license requirements, data source ingestion and retention targets, scanning models (e.g., cloud scan versus Outpost), and cloud provider identity and access management (IAM) requirements (e.g., least-privilege)

8 concepts · 25 questions
  1. Cortex Cloud deployment models
  2. Cortex Cloud license types and entitlements
  3. Data source ingestion methods
  4. Data retention configuration
  5. Cloud scan model
  6. Outpost scan model
  7. Cloud provider IAM requirements
  8. Least-privilege IAM design

1.3 Determine network communication and connectivity requirements for Cortex Cloud components (e.g., egress rules, URLs, ports, regional endpoints)

5 concepts · 17 questions
  1. Identify Cortex Cloud components
  2. Determine egress requirements
  3. Understand regional endpoints
  4. Map ports and protocols
  5. Apply connectivity best practices

1.4 Explain the configuration and management lifecycle of user identity, roles, permissions, and access controls within a Cortex tenant (e.g., Scope-Based Access Control [SBAC], custom Role-Based Access Control [RBAC] roles, API keys)

8 concepts · 22 questions
  1. Identity Lifecycle Management
  2. Role Definition and Assignment
  3. Scope-Based Access Control (SBAC)
  4. Custom Role-Based Access Control (RBAC) Roles
  5. Permission Management
  6. API Key Management
  7. Access Control Configuration
  8. Lifecycle Governance

1.5 Identify and describe cost optimization methods (e.g., scan cadence, duplicate audit logs)

4 concepts · 18 questions
  1. Cost optimization in cloud security
  2. Scan cadence optimization
  3. Duplicate audit logs management
  4. Other cost optimization methods

2.1 Explain the onboarding and configuration process for cloud provider resources (e.g., AWS, Azure, GCP, OCI)

8 concepts · 29 questions
  1. Cloud provider onboarding workflow
  2. Data Security Posture Management (DSPM) capabilities
  3. Audit log integration and analysis
  4. Cortex XSIAM analytics for cloud data
  5. Agentless scanning for cloud workloads
  6. Container registry scanning options
  7. Serverless function scanning
  8. Cloud scan vs. Outpost deployment

2.2 Explain the process of onboarding and configuring data and AI sources (e.g., Office 365, Databricks, Azure Foundry)

5 concepts · 21 questions
  1. Onboarding data sources
  2. Configuring data sources
  3. Onboarding AI sources
  4. Configuring AI sources
  5. Integration best practices

2.3 Explain the process of onboarding application development and deployment systems (e.g., GitHub, Jenkins)

7 concepts · 29 questions
  1. Onboarding Development Systems
  2. GitHub Integration Steps
  3. Jenkins Integration Steps
  4. Authentication and Permissions
  5. Repository and Pipeline Configuration
  6. Scanning and Policy Enforcement
  7. Troubleshooting Integration Issues

2.4 Explain the process of container registry integration (e.g., JFrog, Docker, GitLab)

6 concepts · 27 questions
  1. Container Registry Integration Overview
  2. JFrog Artifactory Integration
  3. Docker Registry Integration
  4. GitLab Container Registry Integration
  5. Authentication and Access Control
  6. Image Scanning and Policy Enforcement

2.5 Explain the integration process for third-party static application security testing (SAST) / Software Composition Analysis (SCA) tools (e.g., Semgrep, Veracode, Generic SARIF)

7 concepts · 21 questions
  1. Integration Workflow
  2. Tool Configuration
  3. SARIF Format Handling
  4. API and Webhook Integration
  5. Result Mapping and Normalization
  6. Pipeline Integration
  7. Troubleshooting Integration

2.6 Explain the deployment and configuration process for Broker VM

7 concepts · 25 questions
  1. Broker VM Overview
  2. Deployment Prerequisites
  3. Deployment Process
  4. Configuration Settings
  5. Integration with Security Services
  6. Traffic Forwarding and Inspection
  7. Troubleshooting and Maintenance

3.1 Explain the process of dashboard creation and configuration using XQL

8 concepts · 27 questions
  1. XQL Overview
  2. Dashboard Creation Workflow
  3. Dashboard Configuration Options
  4. XQL Query Basics
  5. Widget Creation and Customization
  6. Dashboard Widget Interaction
  7. Saving and Sharing Dashboards
  8. Dashboard Management and Maintenance

3.2 Explain the creation and configuration process for static and dynamic asset groups

7 concepts · 18 questions
  1. Static Asset Groups
  2. Dynamic Asset Groups
  3. Creating Static Asset Groups
  4. Creating Dynamic Asset Groups
  5. Configuring Asset Group Settings
  6. Managing Asset Group Membership
  7. Use Cases for Asset Groups

3.3 Explain the creation and configuration of cloud security rules and policies (e.g., attack path, configuration, data, identity, network exposure, AI)

7 concepts · 20 questions
  1. Cloud Security Rules and Policies Overview
  2. Attack Path Rules and Policies
  3. Configuration Rules and Policies
  4. Data Security Rules and Policies
  5. Identity Security Rules and Policies
  6. Network Exposure Rules and Policies
  7. AI Security Rules and Policies

3.4 Explain the creation and configuration of cloud workload rules and policies (e.g., custom rules, scanner type, misconfiguration, malware, secrets, trusted images)

8 concepts · 18 questions
  1. Cloud Workload Rules Overview
  2. Custom Rules Creation
  3. Scanner Type Selection
  4. Misconfiguration Rules
  5. Malware Detection Rules
  6. Secrets Detection Rules
  7. Trusted Images Policy
  8. Policy Enforcement and Alerting

3.5 Explain the creation and management of vulnerability policies (i.e., issue creation and prevention)

7 concepts · 22 questions
  1. Vulnerability Policy Fundamentals
  2. Policy Creation Process
  3. Policy Configuration Options
  4. Issue Creation from Policies
  5. Prevention Mechanisms
  6. Policy Management and Maintenance
  7. Policy Testing and Validation

3.6 Identify and describe methods for managing custom and out-of-the-box compliance standards / controls, assessments, and reporting

7 concepts · 30 questions
  1. Custom Compliance Standards
  2. Out-of-the-Box Compliance Standards
  3. Managing Compliance Controls
  4. Compliance Assessments
  5. Assessment Results Interpretation
  6. Compliance Reporting
  7. Report Scheduling and Distribution

3.7 Explain the deployment of Kubernetes connectors

5 concepts · 21 questions
  1. Kubernetes connector deployment prerequisites
  2. Kubernetes connector installation methods
  3. Kubernetes connector configuration
  4. Kubernetes connector validation
  5. Kubernetes connector troubleshooting

3.8 Identify and describe data security classification settings and scanning options

2 concepts · 8 questions
  1. Data classification settings
  2. Scanning options

4.1 Explain the deployment and configuration of XDR agents (e.g., virtual machines VMs, Containers as a Service [CaaS], serverless functions, Kubernetes)

6 concepts · 21 questions
  1. XDR Agent Deployment on VMs
  2. XDR Agent Deployment on CaaS
  3. XDR Agent Deployment on Serverless Functions
  4. XDR Agent Deployment on Kubernetes
  5. Agent Configuration and Management
  6. Agent Lifecycle and Updates

4.2 Explain the process of endpoint protection configuration

7 concepts · 21 questions
  1. Endpoint profiles
  2. Prevention profiles
  3. Extension profiles
  4. Exception profiles
  5. Endpoint policies
  6. Endpoint groups
  7. Group-based policy assignment

4.3 Explain the process of third-party API gateway integration (e.g., AWS, API Gateway, APIM, Apigee)

7 concepts · 29 questions
  1. API Gateway Integration Overview
  2. AWS API Gateway Integration
  3. Azure API Management (APIM) Integration
  4. Apigee Integration
  5. Traffic Monitoring and Logging
  6. Policy Enforcement and Threat Prevention
  7. Troubleshooting and Validation

4.4 Explain the creation and configuration process for Cloud Detection and Response (CDR) and Threat Management

9 concepts · 32 questions
  1. Detection rule types
  2. Correlation rules
  3. Behavioral IOC (BIOC) rules
  4. Indicator of Compromise (IOC) rules
  5. Analytic rules
  6. Detection rule creation
  7. Automation playbook purpose
  8. Playbook creation and configuration
  9. Playbook integration with detection rules

5.1 Identify and evaluate Application Security Posture Management (ASPM) features and functionality

7 concepts · 24 questions
  1. ASPM Overview
  2. Business Application Identification
  3. Manual Business Applications
  4. Dynamic Business Applications
  5. SLA Definition for Issues
  6. SLA Configuration and Management
  7. SLA Evaluation and Monitoring

5.2 Explain rule and policy deployment and management

6 concepts · 27 questions
  1. Code security fundamentals
  2. Security scanning in CI/CD
  3. AI-recommended guardrails overview
  4. Implementing AI-recommended guardrails
  5. CI/CD policy integration
  6. Policy management in CI/CD

5.3 Explain the configuration and management of repository scanning (e.g., Infrastructure as Code [IaC], secrets, SCA, IaC drift detection)

6 concepts · 24 questions
  1. Repository Scanning Overview
  2. IaC Scanning
  3. Secrets Scanning
  4. SCA (Software Composition Analysis)
  5. IaC Drift Detection
  6. Scanning Configuration and Management

5.4 Explain the deployment and configuration of Cortex Cloud application security IDE plugins (i.e., VS Code, JetBrains)

8 concepts · 27 questions
  1. IDE Plugin Overview
  2. Installation and Setup
  3. Authentication and Connection
  4. Scanning and Findings
  5. Remediation Workflow
  6. Configuration Options
  7. Integration with CI/CD
  8. Troubleshooting

5.5 Identify and describe the steps to install, configure, and execute Cortex CLI in workflows

4 concepts · 8 questions
  1. Cortex CLI Installation
  2. Cortex CLI Configuration
  3. Executing Cortex CLI Commands
  4. Integrating Cortex CLI into Workflows

6.2 Demonstrate knowledge of troubleshooting Cortex Cloud Workload components (e.g., agents / connectors, connectivity issues)

8 concepts · 20 questions
  1. Cortex Cloud Workload Components Overview
  2. Agent Installation and Configuration Troubleshooting
  3. Connector Setup and Integration Troubleshooting
  4. Connectivity and Communication Issues
  5. Agent Health and Status Monitoring
  6. Log and Diagnostic Data Analysis
  7. Common Error Codes and Resolution
  8. Escalation and Support Procedures

6.3 Demonstrate knowledge of troubleshooting communication gaps between customer-managed outposts and the Cortex tenant

4 concepts · 13 questions
  1. Communication Architecture
  2. Common Failure Points
  3. Diagnostic Tools
  4. Troubleshooting Methodology

6.4 Demonstrate knowledge of authentication failure resolution (OAuth / PAT) and webhook delivery issues when connecting version control systems (VCS) (e.g., GitHub, GitLab) and CI/CD systems (e.g., Jenkins) to Cortex Cloud

5 concepts · 16 questions
  1. OAuth authentication failure diagnosis
  2. PAT authentication failure diagnosis
  3. Webhook delivery troubleshooting
  4. VCS and CI/CD integration configuration review
  5. Cortex Cloud authentication logs and error interpretation

6.6 Identify and describe access and permissions troubleshooting issues

13 concepts · 40 questions
  1. Access and permission troubleshooting overview
  2. Diagnosing authentication failures
  3. Diagnosing authorization failures
  4. Troubleshooting user and group permissions
  5. Troubleshooting service account and API key permissions
  6. Troubleshooting cross-account and cross-tenant access
  7. Troubleshooting conditional access and policy enforcement
  8. Troubleshooting access to cloud resources and services
  9. Troubleshooting access to management plane and APIs
  10. Troubleshooting access to data and encryption keys
  11. Troubleshooting access in hybrid and multi-cloud environments
  12. Troubleshooting access using logs and monitoring tools
  13. Troubleshooting access with Palo Alto Networks tools

6.7 Explain the process of diagnosing / determining the source of an unexpected Cloud cost increase

9 concepts · 29 questions
  1. Identify cost increase sources
  2. Analyze cost anomalies
  3. Review billing and usage reports
  4. Inspect resource configurations
  5. Evaluate cost allocation tags
  6. Check for orphaned or idle resources
  7. Assess data transfer and egress costs
  8. Verify third-party and marketplace charges
  9. Document and communicate findings
Ready to practice?Test your knowledge with exam-style questions or take an intelligent quiz tailored to your level.
Practice Free Questions

Percentages reflect share of the current practice bank, not official exam weightings — no structured per-skill weight is published for CLOUD-SECURITY-ENGINEER, so none is invented.